I am executing a search like the following:
index=x sourcetype=t | eval {Property} = Value | stats latest by ID
This takes memory proportional to the amount of rows, and for all time, that means more than 10G of memory. I understand that stats needs to keep an accumulator, but I would like it to limit the amount of memory and start using disk instead, meaning a slower search, but less memory usage.
Can I limit the memory usage of stats this way?
... View more